Analysis
-
max time kernel
148s -
max time network
154s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
14-09-2024 22:07
General
-
Target
558234427065b190153597d49b26a64fda69ce6ead7419d568702e464115bc21.apk
-
Size
4.5MB
-
MD5
9998c68a71fd2e2035c30967f48f4332
-
SHA1
d2f7934bee6bbcbd33f872798ea47f47ce600936
-
SHA256
558234427065b190153597d49b26a64fda69ce6ead7419d568702e464115bc21
-
SHA512
a9341fabd87b575ab4b034ea87bc7d6f7d4e9cac5b2785c6698ec8a4135aa075833f916a10c8ed3ed7dab2c1da32d3f88094e3f3f219c82a847bc5301beee67e
-
SSDEEP
98304:XqQ+yElnnZDdBQ4m28aatk2Js0ugCdyNB/f9hsx2KJlianRBexzBF:OnlnPBQVraatXJegCdqhQ2klfnirF
Malware Config
Extracted
hook
http://80.64.30.123
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.bolaoixyx.pacaaopiq1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5a2c5c17b3307726055b49289cc4646e0
SHA191557d92b9e519a399685eaab27a0858a3d4dd37
SHA256f5c5c2195cf1e141b7cafb2780005c8765dad1a8edd9293a57e6a201b0568938
SHA5121782344a2fcfdad5cbe33d018a5d7c35c0000ec9da2c5fc7ff56ac74f697b17450be36fcfb4637590c0a04762b56eb8c7ba6f8c54f264a1f82a5f79d4421c26f
-
Filesize
1.0MB
MD5fca9d42e2678a461dd90a098e693ae4b
SHA1a19558fb6a83ca6eaf0cd5dcf2a86c05a182f3be
SHA25690c7aeec28ab0984873209c1463234d85b9002a03bfe1970a12c290cee5b0fc3
SHA512bb9303c3c4c7777809d8786f67fa19d449b092ec36e0f3884a88ab071b63a250d3923f514baaa54fb8be745805289cd7132799bad1670fe30ef496bad09dda7f
-
Filesize
1.0MB
MD5fb24f22a86d8f227257da2f25b56a551
SHA12af02a7d034bd8ab5dd831e2b5ce1f4de6b3a64e
SHA256037a690236cef5d87b743c8dcb9e412b48f694ff1958143667f74f48b5d5ae03
SHA5128ceaa97c365d064fb71b93b961bd36e963bb58616919d246e8895057823b55a17729331fc97c6fd776769588f6b7029dc0da1e58bb1ffce1b9d0244e50db7876
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5834c583a57811ba33fe54b767076ba10
SHA1a68760f554dd6ce7286b5f32af1c12ddd695925e
SHA25685537c3a316f88aa5d86f15b3244b66e2c3fb0ce883ec21324f48d800cf2690b
SHA5126f618790bf78b5fae069e2cfc3c565cf256d714e01dd6ca813cf347dd6590a1487c6dd61e460f9fa235cb74fef3104fffcffd41f1eaf623266cb2c285435e5ed
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD59d1be927b705f14c756f18531ceec343
SHA12e3a0b0204355e6d1de8f2b5543a0d9e051a45ad
SHA256aa65381266cf6fba7af1a0b2c8d5dde876438832464dea0bb39fe5dd1c87f5ec
SHA512f5a126e6723cddbccd09adac3eab628a3687cfb95f1fa76f66fa664601bd952c5b7545720914728751dac8f91143ef04c28cf59ccb35be37b22a5c9406854a4a
-
Filesize
108KB
MD5e7598c246ed8492902ee2a33514aa656
SHA1831095b67b7900b8062ec40af9e2adbe187d385e
SHA25699fa99522c0da2dd662c3fad12855224d66089dc2e8508744ba5c005c455c58b
SHA5129262c66cf8271e302dbbbc2f11ef74cbae2f90fd2dbeec547d23a2187aef975eb45b478cc69d42b226be5e994f9b99e97c1b515ebb8c99f4699d74459e78b31a
-
Filesize
173KB
MD5b8fe07ec4ed7b31556f8863ffc2eda7b
SHA179f80bfb392526af1950fe27afeacb5e437a56f1
SHA2568e652d9e4d5bedf08296d4c347ae57200df288c87002629b9c7920f60df9e1c5
SHA512d2b110a20c6c6c89377292486f669ccf2a12bf6f075609e80722b89a7f629570b4c2c95f3151adbda82c41a6cfdda420be5e3209dc3f05ca9372a46e01b9c8dc